The App Store Connect CLIthat holds no keys
Every CLI for App Store Connect starts the same way: put your .p8 private key on this machine. MetaRun's CLI does not. npx metarun is a thin client for the same hosted, 245-tool server that powers the dashboard and the MCP uplink: your key stays envelope-encrypted server-side, a revocable token rides each call, and every write previews before it applies.
Shell uplink established: 245 tools from any terminal. The machine holds a revocable token, never your Apple key.
- 01
Log in once, with a token you can burn
Mint a personal access token in Settings and run npx metarun login. The CLI verifies it against the server before saving (file mode 0600), and a lost laptop is one revoke away, because the machine never held your Apple credentials in the first place.
- 02
Find the tool, then run it
metarun tools pricing greps the surface; metarun run calls a tool with JSON arguments. All 245 tools are there: pricing computation, metadata in every locale, screenshot publishing, releases, reviews, ASO checks.
- 03
Pipe it like a real Unix tool
Results are JSON on stdout and progress is on stderr, so metarun run apple_list_apps | jq works with no flags. Scripts get exit codes; humans get errors that say what to do next.
- 04
Writes keep the safety contract, even in a script
Preview tools return a confirmToken over the exact before/after; the apply refuses without it and rejects if the store drifted underneath you. A shell script physically cannot skip the look-before-write, and everything lands in revertible change history.
Nutrio: AI Calorie Tracker
4.6· v1.15.3 · app.nutr.io
$ npx metarun login
✓ Connected. 245 tools available.
$ npx metarun run apple_preview_set_promotional_text \
'{"bundleId":"app.nutrio","locale":"en-US","text":"Summer sale: Pro yearly 40% off."}'
"before": "Track macros in seconds."
"after": "Summer sale: Pro yearly 40% off."
"confirmToken": "9f2c…d81a"
$ npx metarun run apple_apply_set_promotional_text \
'{ …, "confirmToken":"9f2c…d81a"}'
✓ live on the App Store · recorded in change history · revertible
Live specimen: Nutrio's promo text shipped from a shell
Why a CLI should not hold your Apple key
The standard design for an App Store Connect CLI is local: your .p8 private key sits in a dotfile or keychain on every machine that runs it, including CI runners. That key is full write access to your store, it does not expire, and revoking it breaks everything that shares it. Every laptop and pipeline holding it is part of your attack surface.
MetaRun inverts this. The key is uploaded once, envelope-encrypted, and lives only server-side; the CLI authenticates with a personal access token that is scoped to your account, stored as a hash, and revocable one at a time. Ten machines means ten tokens, and losing one costs you one revoke, not a key rotation across your whole toolchain.
Scriptable without being reckless
Automation and safety usually trade off: a scriptable store CLI will happily push a wrong price to 175 countries at 2am. MetaRun's write contract survives scripting because it is structural, not interactive: mutations are preview/apply pairs, the preview mints a confirm token bound to the exact change, and the apply revalidates against the live store before writing. Your script sees the diff as data and must pass the token back deliberately.
Every applied change is recorded in change history with its source, and most are one-tap revertible from the dashboard or one call from the CLI. A cron job that repriced wrongly is an undo, not an incident.
Where it sits next to fastlane and build CLIs
Build-side tools (fastlane, Xcode, build-and-upload CLIs) own the road from source code to an uploaded binary, and they are good at it. MetaRun's CLI owns everything after: attach the processed build to a version, sweep the listing for what would block submission, stage metadata and pricing, publish screenshots, submit, and watch review state.
The two compose in one pipeline: your existing lane uploads the build, then npx metarun run apple_preview_set_version_build picks it up and the release finishes without anyone opening App Store Connect. If you already keep a fastlane deliver folder, MetaRun imports and exports that exact layout too.
One tool surface, four ways in
The CLI is not a separate product with its own coverage gaps: it is the fourth transport over the same registry as the dashboard, MILO chat and voice, and the MCP server. When a capability ships, all four get it the same day, with the same input schema and the same preview gate. metarun connect prints the wiring for the other surfaces, so the shell, the IDE agent, and the browser stay one account with one audit trail.
- Apple keys on your machine
- 0
- Tools from one binary-free npx
- 245
- Package size
- 9 kB
- Writes preview-gated
- 100%
Frequently asked questions
Is there a CLI for App Store Connect?
Yes. npx metarun gives you 245 App Store Connect operations from any shell: pricing, metadata, screenshots, releases, reviews, and ASO. It is a thin client for MetaRun's hosted tool server, so there is no binary to install and no API wrapper to maintain.
Does the MetaRun CLI need my .p8 private key?
No, and that is the point. Your key is uploaded once to MetaRun and stored envelope-encrypted server-side. The CLI holds only a revocable personal access token, so no laptop, dotfile, or CI runner ever carries store-wide credentials.
How is this different from fastlane?
fastlane owns the build side: compiling, signing, uploading binaries, and it is excellent there. MetaRun owns the store side: pricing across 175 territories, metadata in every locale, screenshots, submissions, reviews, ASO. They chain cleanly: fastlane uploads the build, MetaRun attaches it, sweeps readiness, and submits.
Can I use it in CI/CD?
Yes. Set METARUN_TOKEN in your pipeline's secrets and call npx metarun run directly, no login step. Output is JSON on stdout with clean exit codes, and every write still runs through the preview/confirm contract, so a misconfigured job cannot blind-write to your store.
Can I undo something a script changed?
Yes. Every applied change is recorded in change history with its source, and most operations are revertible: the revert rebuilds the previous values and stages them through the same preview/apply pipeline. One bad automated change is one undo.
What is the difference between the CLI and the MCP server?
Same server, different caller. The MCP endpoint is for AI agents inside IDEs like Claude Code; the CLI is for humans and scripts in a shell. They share your tokens, your tool surface, and your change history, and metarun connect prints the MCP wiring when you want both.
Can my coding agent learn App Store workflows automatically?
Yes: install the open-source metarun-skills pack (npx skills add metarun/metarun-skills, or via the Claude Code plugin marketplace). It teaches agents complete missions like release handoff, worldwide PPP repricing, and listing localization, all driving these same CLI tools with previews before every write.
Related capabilities
Capability file 07
MCP server
Drive your entire App Store from Claude Code or any MCP-capable IDE.
Open fileCapability file 08
fastlane import
Import your fastlane metadata folder in one previewed change; export it back anytime.
Open fileCapability file 01
Bulk pricing
Change app, IAP, and subscription prices across all 175 App Store countries in one staged pass.
Open fileMILO standing by
14-day free trial. No credit card. Your keys stay encrypted.